Clear agreements. For your practice.

1. Who we are and who ombra is for

These terms are an agreement between you and ombra (‘we’), established at Abeliaerf 37, 4125 WH Hoef en Haag, the Netherlands, KVK (Dutch Chamber of Commerce) 88959945. ‘You’ are the psychologist, therapist or practice with an account. ‘ombra’ is also the software at app.ombracare.com, with the forms, booking pages and registration forms you publish with it.

ombra is for psychologists, therapists and other care providers, for the work in their practice in Belgium or the Netherlands. You use ombra as a professional, not as a consumer.

You can save, print or download these terms as a PDF. They contain a choice of law and court (article 17).

2. How the agreement is made

The agreement begins when you create an account and accept these terms. With that you also conclude the data processing agreement, which is part of these terms. We record which version you accepted and when.

If you act on behalf of a practice, you must be authorised to bind that practice. Someone who uses one of your forms or booking links does not conclude an agreement with us by doing so.

The privacy statement explains what ombra itself does with data. It is information, not consent you give. Would you like a signed data processing agreement for your own records? E-mail support@ombracare.com.

3. What ombra is, and what it is not

ombra is software to run your practice: records, notes, appointments, applications, groups and documents. ombra is not a care provider, makes no diagnoses and gives no clinical advice.

You remain responsible for the care you give and for what is in your records. You check what ombra makes or brings in for you yourself, such as a certificate of attendance, an overview or an imported appointment. You work according to the law and your professional code of ethics. So:

• you keep a record and retain it as the law requires: in Belgium the Act on the quality of healthcare practice (Kwaliteitswet), in the Netherlands the Medical Treatment Contracts Act (WGBO);
• you tell your clients that you work with ombra, and ask their consent to keep their data electronically if your professional code requires it;
• you respect your clients’ rights as patients, such as access to and a copy of the record;
• you keep your professional secrecy.

ombra helps you with this, among other things with retention periods, a log of who opened or changed a record and a complete export. ombra is not connected to the eHealth platform.

4. Your account

Your account is personal. Share your sign-in with no one, not even a colleague: anyone who works with you creates their own account.

Secure your account and the e-mail address you sign in with, and use your ombra password nowhere else. Set up an authenticator as an extra lock: we strongly recommend it. Keep your recovery codes in a safe place. If you think someone else can get into your account, e-mail support@ombracare.com at once. We can block a sign-in session or connection to limit harm.

You are responsible for what happens through your account, and for whom you admit to a shared intake space. What a member has already downloaded there, no one can take back.

5. Your data stays yours

Everything you put in ombra, and what people fill in through your forms, stays yours. You are the controller. ombra processes that data only on your behalf, according to the data processing agreement. Where personal data is concerned, the data processing agreement takes precedence over these terms.

You give us the right to store and process your data only as far as ombra needs to in order to work for you. We do not sell it, do not use it for advertising and do not train AI with it. To make ombra work and to improve it, we use technical data without content, such as times and error codes.

The software, the design, the name ombra and Folio remain ours. You may use ombra for as long as the agreement runs. If you share an idea with us, we may use it to make ombra better. Leave client data out of it.

6. Calendar and mail

You connect your calendar and mail from Google or Microsoft if you want to. Your agreements with Google or Microsoft then apply as well. ombra works on your behalf: it reads what you allow and sends mail from your mailbox. Connect only an account you are authorised to use.

• Check imported appointments, and the recipients and content of a mail before you send it.
• Automatic messages to applicants and registrants, such as a confirmation of receipt, are on by default. You switch them off per form. They name you, but never the question or the answers of the person who applies or registers.
• You are responsible for the mails that leave from your mailbox.
• If Google or Microsoft changes what a connection may do, it may stop or work differently. We let you know what that means for you.

7. Forms and your booking page

With ombra you put an application form, a booking page and registration forms for groups online, also on your own website. The following applies:

• You tell everyone who fills in a form who is responsible for the data and what you do with it. Our privacy text for your practice helps you get started.
• You ask only for what you need. Do not ask for a Belgian national register number (rijksregisternummer) or a Dutch citizen service number (BSN), and about someone’s health only what you need to follow up the application.
• Your booking page shows no privacy text of its own. Put a link to your privacy statement next to the link to your booking page.
• The script with which you put a form on your website sets no cookies and stores nothing in your visitors’ browsers.
• If you close your account, your forms and booking page stop at once.

8. Fair use

You use ombra for your practice, as it is intended. So you do not:

• use ombra for anything unlawful, or to send spam or unsolicited messages;
• view or change data you are not authorised to;
• try to get around the security, or test it outside our rules for reporting vulnerabilities;
• upload harmful files, automatically extract data from ombra or overload it;
• resell ombra or offer it to others.

Sensitive subjects that belong to your care may of course be in it. If there is a threat of serious harm to ombra, other users or your clients, we may temporarily restrict your access, no more than necessary. We tell you why beforehand. If it is so urgent that this is not possible, then as soon as possible afterwards.

9. Availability, maintenance and backups

We do our best to keep ombra available at all times, but we promise no percentage. We announce maintenance during which ombra briefly does not work in advance. Where possible, we plan it outside working hours. With an urgent security problem we step in at once.

We make continuous backups of the database, with a copy in a second region. Documents are spread over several datacentres, with their earlier versions. With these we restore your data after a fault or error. How, and how quickly we aim to do that, you can read under Security. Do agree how your care continues if ombra briefly does not work, as you would for a power cut.

Need help? E-mail support@ombracare.com. Tell us what you did, what happened and when. Leave out client data and codes: if we do need to look at something in your workspace, we agree that with you first.

10. Prices and payment

You only pay a price you agreed to beforehand. You see what ombra costs before you choose a paid subscription. A paid subscription only begins if you choose it yourself: free use never turns into paid use by itself.

Prices are in euros and exclusive of VAT. How VAT is applied, you see on your invoice. If you do not pay on time, you first receive a reminder with a reasonable period. Only after that may we restrict your access. Taking your data with you is then still always possible.

We change a price only for a good reason, and let you know at least 30 days in advance. You can then cancel free of charge before the new price takes effect, and we refund what you paid in advance for the time after that. If we agreed a price for a fixed period, it applies until the end of that period.

11. Duration and cancellation

The agreement runs for an indefinite period. You cancel whenever you like, without notice period and without penalty: by closing your account in ombra, under Instellingen → Gegevens (Settings → Data), or by e-mailing support@ombracare.com. A paid subscription runs until the end of the period you already paid for.

We too can cancel, or stop ombra altogether. We then let you know well in advance, with enough time to take your data with you and switch. We refund what you paid in advance for the time after that.

We may end the agreement at once if you seriously breach these terms and do not stop after a warning, or if the law obliges us to. Even then you get your data, as in article 12.

12. Leaving and taking your data with you

Taking your data with you is always possible, even without cancelling, and it costs nothing.

• What it contains. Everything you and your clients put in ombra: records, sessions, notes with all their versions, homework, documents, appointments, applications, groups, forms and their answers, your settings, and the log of who opened or changed what.
• How. A ZIP with all your data as JSON and all your documents, with a checksum (SHA-256) per document. You can also download individual overviews as CSV.
• What it does not contain. Technical parts, such as your sign-in sessions, keys and the mail queue, and our own security log. A document the malware scan stopped has no content to hand over.

This is how you leave:

1. You download your complete export. When you close your account, ombra asks for an export no more than 24 hours old, so you lose nothing.
2. You close your account. For another 30 days you can sign in to download your export or reopen your account. Your forms and booking page no longer work then.
3. After that we delete everything in your workspace, including the log. It disappears from the database backups within 35 days. We clean up earlier versions of documents once they are older than 35 days; after that they can still be recovered for 35 days. All that remains: that and when your account was closed, your invoices if you paid (7 years, for the accounts), and our security logs with identifiers and without content (365 days). If you worked with colleagues, they see ‘Deleted account’ where you did something. On request we confirm the deletion in writing.

Have you already secured your data and do you want us to delete everything without a new export? That is possible too, as article 12 of the data processing agreement says.

Switching to another service

• Are you switching to another service or to your own systems? Let us know at support@ombracare.com. The switch begins without notice period and takes no more than 30 calendar days.
• All that time ombra keeps working as usual and we protect your data. We help you and your new supplier with the export, explain how it is structured and report what may stand in the way of the switch. If you cannot export yourself, we agree a secure transfer.
• If it is technically not possible within 30 days, we tell you within 14 working days why, and how long it will take instead: no more than seven months. You can extend the switching period once, for as long as you consider necessary.
• After the switch we confirm that the agreement ends. After that you can still retrieve your data for at least 30 calendar days. Only then do we delete everything, as above.
• Switching costs nothing.

After the deletion ombra no longer has your records. The law requires you to keep a record for a long time: in Belgium at least 30 years after the last contact (Kwaliteitswet), in the Netherlands as a rule 20 years (WGBO). So keep your export safe, or move your records to your new record system.

Are you stopping your practice, or can you no longer do your work? Then your records go to a colleague or successor according to the law. We help whoever takes them over, after we have checked that they are authorised to do so.

13. Liability

If something goes wrong through our fault, we compensate the direct damage you suffer as a result, such as the costs of restoring lost data. Per year that is at most what you paid us in the twelve months before the damage arose. We are not liable for indirect damage, such as lost income.

These limits do not apply in case of intent or gross negligence, nor where the law does not allow them. Nor do they detract from our duty to store, secure and return your data, or from your clients’ rights under the GDPR.

14. Confidentiality

We treat everything we learn about you and your practice as confidential. Everyone who works for ombra and can reach data has a written duty of confidentiality.

We respect your professional secrecy. We do not look in your records, unless you ask us to, it is necessary for a fault or a security incident, or the law requires it. Who can reach data and when is set out in the data processing agreement.

You too keep confidential what you receive from us and is not public, such as information about our security.

15. Force majeure

If we temporarily cannot provide ombra because of something beyond our control, such as a natural disaster or a major outage at a supplier that we could not prevent, we are not liable for it. Force majeure never releases us from the duty to protect and return your data. If it lasts so long that you cannot reasonably be expected to wait, you may end the agreement free of charge.

16. Changes

ombra gets better, and sometimes something changes. If we remove a feature you rely on, we let you know in advance.

We change these terms or the data processing agreement only for a good reason, such as a new law, security, a new feature or a new service provider. We e-mail you at least 30 days before the change takes effect, and ask you in the app to accept it. If you do not agree, you cancel free of charge before it takes effect: we prepare your export for you and refund what you paid in advance for the time after that. A better wording that changes nothing about your rights, we make without that period.

A change never applies retroactively. We send you earlier versions on request. What changed, you can read under Versions.

17. Complaints, law and court

If you are unhappy about something, e-mail support@ombracare.com. We answer as quickly as we can and look for a solution together.

These terms are governed by Dutch law. Mandatory rules that protect you as a business in Belgium continue to apply, as do the rules for your care in the country where you work. If we cannot work it out together, the competent court in the Netherlands decides. If you start the case, you may also go to the competent court of the place where your practice is established.

Our records, such as the log, count as evidence. You may always prove the contrary. You always keep the right to lodge a complaint with a supervisory authority.

18. Final provisions

• If a provision is invalid, the rest continues to apply. We replace it with a valid provision that comes as close to it as possible.
• If documents contradict each other, the data processing agreement takes precedence for personal data, and after it these terms. A deviation we agreed together in writing takes precedence over both.
• If we transfer ombra to another business, we let you know at least 30 days in advance and you may cancel free of charge, with a refund of what you paid in advance. Your data only goes along under the same agreements.
• We send messages about this agreement to your account’s e-mail address.
• These terms were drawn up in Dutch, and this is an English translation. Where the two differ, the Dutch text prevails.

19. This website

On ombracare.com you discover how ombra works. The examples contain fictional clients, appointments and records, and they are not care advice. Do not put real client data in an example.

The forms for updates and ideas commit you to nothing: you buy nothing and take out no subscription. Texts, images and Folio on this website belong to ombra. If you want to reuse something, ask us.